skinport[.]top

Analysis performed on 24 July 2026 identifies skinport.top as an active brand‑impersonation infrastructure targeting Steam users. The domain was registered on 4 October 2025 through Web Commerce Communications Limited and resolves to the IPv4 address 82.146.60.75, which belongs to AS29182 JSC IOT in the Russian Federation. No TLS certificate is presented, indicating that the site operated only over HTTP. The public page title returned was “AD PANELL”, which does not correspond to the Steam brand and suggests a generic or placeholder page. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service.

In the AlienVault Open Threat Exchange the domain is referenced in one pulse, confirming its inclusion in threat‑intel feeds. VirusTotal scans show that four of ninety‑five security vendors flagged the domain, reinforcing the suspicion of malicious intent. The hosting environment is managed by Google’s Cloud DNS, as evidenced by the authoritative name servers ns‑cloud‑e1.googledomains.com, ns‑cloud‑e2.googledomains.com and ns‑cloud‑e3.googledo. The Gridinsoft trust score of 0 out of 100 further indicates a lack of legitimacy.

Current HTTP status shows the site taken offline, which limits immediate observation but does not remove the underlying infrastructure. Defenders should add skinport.top to URL filtering and DNS block lists, monitor traffic to 82.146.60.75 for any residual connections, and consider extending detection rules to cover similar newly registered domains that resolve to the same ASN. Ongoing review of threat‑intel feeds for additional pulses referencing this domain or related indicators is recommended. Because the page content has not been captured, analysts should treat the lack of visual evidence as a gap and prioritize retrieval of any archived snapshots if available.